API: Filter lists of IDs before sending them to the database
[lhc/web/wiklou.git] / includes / api / ApiBase.php
index bb86536..9ea8c6d 100644 (file)
@@ -21,6 +21,7 @@
  */
 
 use Wikimedia\Rdbms\IDatabase;
+use MediaWiki\MediaWikiServices;
 
 /**
  * This abstract class implements many basic API functions, and is the base of
@@ -267,11 +268,14 @@ abstract class ApiBase extends ContextSource {
        /** @var array Maps extension paths to info arrays */
        private static $extensionInfo = null;
 
+       /** @var int[][][] Cache for self::filterIDs() */
+       private static $filterIDsCache = [];
+
        /** @var ApiMain */
        private $mMainModule;
        /** @var string */
        private $mModuleName, $mModulePrefix;
-       private $mSlaveDB = null;
+       private $mReplicaDB = null;
        private $mParamCache = [];
        /** @var array|null|bool */
        private $mModuleSource = false;
@@ -348,45 +352,7 @@ abstract class ApiBase extends ContextSource {
         * @return array
         */
        protected function getExamplesMessages() {
-               // Fall back to old non-localised method
-               $ret = [];
-
-               $examples = $this->getExamples();
-               if ( $examples ) {
-                       if ( !is_array( $examples ) ) {
-                               $examples = [ $examples ];
-                       } elseif ( $examples && ( count( $examples ) & 1 ) == 0 &&
-                               array_keys( $examples ) === range( 0, count( $examples ) - 1 ) &&
-                               !preg_match( '/^\s*api\.php\?/', $examples[0] )
-                       ) {
-                               // Fix up the ugly "even numbered elements are description, odd
-                               // numbered elemts are the link" format (see doc for self::getExamples)
-                               $tmp = [];
-                               $examplesCount = count( $examples );
-                               for ( $i = 0; $i < $examplesCount; $i += 2 ) {
-                                       $tmp[$examples[$i + 1]] = $examples[$i];
-                               }
-                               $examples = $tmp;
-                       }
-
-                       foreach ( $examples as $k => $v ) {
-                               if ( is_numeric( $k ) ) {
-                                       $qs = $v;
-                                       $msg = '';
-                               } else {
-                                       $qs = $k;
-                                       $msg = self::escapeWikiText( $v );
-                                       if ( is_array( $msg ) ) {
-                                               $msg = implode( ' ', $msg );
-                                       }
-                               }
-
-                               $qs = preg_replace( '/^\s*api\.php\?/', '', $qs );
-                               $ret[$qs] = $this->msg( 'api-help-fallback-example', [ $msg ] );
-                       }
-               }
-
-               return $ret;
+               return [];
        }
 
        /**
@@ -685,11 +651,11 @@ abstract class ApiBase extends ContextSource {
         * @return IDatabase
         */
        protected function getDB() {
-               if ( !isset( $this->mSlaveDB ) ) {
-                       $this->mSlaveDB = wfGetDB( DB_REPLICA, 'api' );
+               if ( !isset( $this->mReplicaDB ) ) {
+                       $this->mReplicaDB = wfGetDB( DB_REPLICA, 'api' );
                }
 
-               return $this->mSlaveDB;
+               return $this->mReplicaDB;
        }
 
        /**
@@ -1784,25 +1750,6 @@ abstract class ApiBase extends ContextSource {
                return $user;
        }
 
-       /**
-        * A subset of wfEscapeWikiText for BC texts
-        *
-        * @since 1.25
-        * @param string|array $v
-        * @return string|array
-        */
-       private static function escapeWikiText( $v ) {
-               if ( is_array( $v ) ) {
-                       return array_map( 'self::escapeWikiText', $v );
-               } else {
-                       return strtr( $v, [
-                               '__' => '_&#95;', '{' => '&#123;', '}' => '&#125;',
-                               '[[Category:' => '[[:Category:',
-                               '[[File:' => '[[:File:', '[[Image:' => '[[:Image:',
-                       ] );
-               }
-       }
-
        /**
         * Create a Message from a string or array
         *
@@ -1853,6 +1800,12 @@ abstract class ApiBase extends ContextSource {
                                        'blocked',
                                        [ 'blockinfo' => ApiQueryUserInfo::getBlockInfo( $user->getBlock() ) ]
                                ) );
+                       } elseif ( is_array( $error ) && $error[0] === 'blockedtext-partial' && $user->getBlock() ) {
+                               $status->fatal( ApiMessage::create(
+                                       'apierror-blocked-partial',
+                                       'blocked',
+                                       [ 'blockinfo' => ApiQueryUserInfo::getBlockInfo( $user->getBlock() ) ]
+                               ) );
                        } elseif ( is_array( $error ) && $error[0] === 'autoblockedtext' && $user->getBlock() ) {
                                $status->fatal( ApiMessage::create(
                                        'apierror-autoblocked',
@@ -1882,6 +1835,41 @@ abstract class ApiBase extends ContextSource {
                }
        }
 
+       /**
+        * Filter out-of-range values from a list of positive integer IDs
+        * @since 1.33
+        * @param array $fields Array of pairs of table and field to check
+        * @param (string|int)[] $ids IDs to filter. Strings in the array are
+        *  expected to be stringified ints.
+        * @return (string|int)[] Filtered IDs.
+        */
+       protected function filterIDs( $fields, array $ids ) {
+               $min = INF;
+               $max = 0;
+               foreach ( $fields as list( $table, $field ) ) {
+                       if ( isset( self::$filterIDsCache[$table][$field] ) ) {
+                               $row = self::$filterIDsCache[$table][$field];
+                       } else {
+                               $row = $this->getDB()->selectRow(
+                                       $table,
+                                       [
+                                               'min_id' => "MIN($field)",
+                                               'max_id' => "MAX($field)",
+                                       ],
+                                       null,
+                                       __METHOD__
+                               );
+                               self::$filterIDsCache[$table][$field] = $row;
+                       }
+                       $min = min( $min, $row->min_id );
+                       $max = max( $max, $row->max_id );
+               }
+               return array_filter( $ids, function ( $id ) use ( $min, $max ) {
+                       return ( is_int( $id ) && $id >= 0 || ctype_digit( $id ) )
+                               && $id >= $min && $id <= $max;
+               } );
+       }
+
        /**@}*/
 
        /************************************************************************//**
@@ -2027,6 +2015,12 @@ abstract class ApiBase extends ContextSource {
                                'autoblocked',
                                [ 'blockinfo' => ApiQueryUserInfo::getBlockInfo( $block ) ]
                        );
+               } elseif ( !$block->isSitewide() ) {
+                       $this->dieWithError(
+                               'apierror-blocked-partial',
+                               'blocked',
+                               [ 'blockinfo' => ApiQueryUserInfo::getBlockInfo( $block ) ]
+                       );
                } else {
                        $this->dieWithError(
                                'apierror-blocked',
@@ -2114,11 +2108,41 @@ abstract class ApiBase extends ContextSource {
                foreach ( (array)$actions as $action ) {
                        $errors = array_merge( $errors, $title->getUserPermissionsErrors( $action, $user ) );
                }
+
                if ( $errors ) {
+                       // track block notices
+                       if ( $this->getConfig()->get( 'EnableBlockNoticeStats' ) ) {
+                               $this->trackBlockNotices( $errors );
+                       }
+
                        $this->dieStatus( $this->errorArrayToStatus( $errors, $user ) );
                }
        }
 
+       /**
+        * Keep track of errors messages resulting from a block
+        *
+        * @param array $errors
+        */
+       private function trackBlockNotices( array $errors ) {
+               $errorMessageKeys = [
+                       'blockedtext',
+                       'blockedtext-partial',
+                       'autoblockedtext',
+                       'systemblockedtext',
+               ];
+
+               $statsd = MediaWikiServices::getInstance()->getStatsdDataFactory();
+
+               foreach ( $errors as $error ) {
+                       if ( in_array( $error[0], $errorMessageKeys ) ) {
+                               $wiki = $this->getConfig()->get( 'DBname' );
+                               $statsd->increment( 'BlockNotices.' . $wiki . '.MediaWikiApi.returned' );
+                               break;
+                       }
+               }
+       }
+
        /**
         * Will only set a warning instead of failing if the global $wgDebugAPI
         * is set to true. Otherwise behaves exactly as self::dieWithError().
@@ -2218,10 +2242,6 @@ abstract class ApiBase extends ContextSource {
        /**
         * Get final module summary
         *
-        * Ideally this will just be the getSummaryMessage(). However, for
-        * backwards compatibility, if that message does not exist then the first
-        * line of wikitext from the description message will be used instead.
-        *
         * @since 1.30
         * @return Message
         */
@@ -2231,17 +2251,6 @@ abstract class ApiBase extends ContextSource {
                        $this->getModuleName(),
                        $this->getModulePath(),
                ] );
-               if ( !$msg->exists() ) {
-                       wfDeprecated( 'API help "description" messages', '1.30' );
-                       $msg = self::makeMessage( $this->getDescriptionMessage(), $this->getContext(), [
-                               $this->getModulePrefix(),
-                               $this->getModuleName(),
-                               $this->getModulePath(),
-                       ] );
-                       $msg = self::makeMessage( 'rawmessage', $this->getContext(), [
-                               preg_replace( '/\n.*/s', '', $msg->text() )
-                       ] );
-               }
                return $msg;
        }
 
@@ -2253,18 +2262,6 @@ abstract class ApiBase extends ContextSource {
         * @return Message[]
         */
        public function getFinalDescription() {
-               $desc = $this->getDescription();
-
-               // Avoid PHP 7.1 warning of passing $this by reference
-               $apiModule = $this;
-               Hooks::run( 'APIGetDescription', [ &$apiModule, &$desc ], '1.25' );
-               $desc = self::escapeWikiText( $desc );
-               if ( is_array( $desc ) ) {
-                       $desc = implode( "\n", $desc );
-               } else {
-                       $desc = (string)$desc;
-               }
-
                $summary = self::makeMessage( $this->getSummaryMessage(), $this->getContext(), [
                        $this->getModulePrefix(),
                        $this->getModuleName(),
@@ -2278,20 +2275,7 @@ abstract class ApiBase extends ContextSource {
                        ]
                );
 
-               if ( $summary->exists() ) {
-                       $msgs = [ $summary, $extendedDescription ];
-               } else {
-                       wfDeprecated( 'API help "description" messages', '1.30' );
-                       $description = self::makeMessage( $this->getDescriptionMessage(), $this->getContext(), [
-                               $this->getModulePrefix(),
-                               $this->getModuleName(),
-                               $this->getModulePath(),
-                       ] );
-                       if ( !$description->exists() ) {
-                               $description = $this->msg( 'api-help-fallback-description', $desc );
-                       }
-                       $msgs = [ $description ];
-               }
+               $msgs = [ $summary, $extendedDescription ];
 
                Hooks::run( 'APIGetDescriptionMessages', [ $this, &$msgs ] );
 
@@ -2343,17 +2327,6 @@ abstract class ApiBase extends ContextSource {
                $name = $this->getModuleName();
                $path = $this->getModulePath();
 
-               $desc = $this->getParamDescription();
-
-               // Avoid PHP 7.1 warning of passing $this by reference
-               $apiModule = $this;
-               Hooks::run( 'APIGetParamDescription', [ &$apiModule, &$desc ], '1.25' );
-
-               if ( !$desc ) {
-                       $desc = [];
-               }
-               $desc = self::escapeWikiText( $desc );
-
                $params = $this->getFinalParams( self::GET_VALUES_FOR_HELP );
                $msgs = [];
                foreach ( $params as $param => $settings ) {
@@ -2361,25 +2334,10 @@ abstract class ApiBase extends ContextSource {
                                $settings = [];
                        }
 
-                       $d = $desc[$param] ?? '';
-                       if ( is_array( $d ) ) {
-                               // Special handling for prop parameters
-                               $d = array_map( function ( $line ) {
-                                       if ( preg_match( '/^\s+(\S+)\s+-\s+(.+)$/', $line, $m ) ) {
-                                               $line = "\n;{$m[1]}:{$m[2]}";
-                                       }
-                                       return $line;
-                               }, $d );
-                               $d = implode( ' ', $d );
-                       }
-
                        if ( isset( $settings[self::PARAM_HELP_MSG] ) ) {
                                $msg = $settings[self::PARAM_HELP_MSG];
                        } else {
                                $msg = $this->msg( "apihelp-{$path}-param-{$param}" );
-                               if ( !$msg->exists() ) {
-                                       $msg = $this->msg( 'api-help-fallback-parameter', $d );
-                               }
                        }
                        $msg = self::makeMessage( $msg, $this->getContext(),
                                [ $prefix, $param, $name, $path ] );
@@ -2642,6 +2600,7 @@ abstract class ApiBase extends ContextSource {
         * @return Message|string|array|false
         */
        protected function getDescription() {
+               wfDeprecated( __METHOD__, '1.25' );
                return false;
        }
 
@@ -2658,6 +2617,7 @@ abstract class ApiBase extends ContextSource {
         * @return array|bool False on no parameter descriptions
         */
        protected function getParamDescription() {
+               wfDeprecated( __METHOD__, '1.25' );
                return [];
        }
 
@@ -2678,6 +2638,7 @@ abstract class ApiBase extends ContextSource {
         * @return bool|string|array
         */
        protected function getExamples() {
+               wfDeprecated( __METHOD__, '1.25' );
                return false;
        }
 
@@ -2690,6 +2651,7 @@ abstract class ApiBase extends ContextSource {
         * @return string|array|Message
         */
        protected function getDescriptionMessage() {
+               wfDeprecated( __METHOD__, '1.30' );
                return [ [
                        "apihelp-{$this->getModulePath()}-description",
                        "apihelp-{$this->getModulePath()}-summary",